Читать книгу Building an Effective Security Program for Distributed Energy Resources and Systems - Mariana Hentea - Страница 83

The SCADA obscurity approach used in SCADA systems is debatable; it has proven that it does not work anymore. Even to this day, many SCADA systems are perceived as either invulnerable to cyber attacks or uninteresting to potential hackers (security by obscurity principle). The obscurity principle implies use of concealment for a design, implementation, etc. to provide security. A system relying on the security through obscurity principle may have theoretical or actual security vulnerabilities, but its owners or designers believe that the flaws are not known and that attackers are unlikely to find them. If the strength of the program's security depends on the ignorance of the user, a knowledgeable user can defeat that security mechanism.

The principle of open design states that the security of a mechanism should not depend on the secrecy of its design or implementation [Bishop 2005]. Designers and implementers of security must not depend on secrecy of the details of their design and implementation to ensure security. A methodology based on economic analysis of the obscurity principle and open systems paradigm for determining when obscurity does not help security (there is no security through obscurity) and when the open paradigm affects security (loose lips sink ships) is described in [Swire 2004]. The proposed model provides a systematic way to identify the costs and benefits of disclosure for security.

Another example is the home area network (HAN), which is enabled by open and interoperable standards. The use of open and interoperable standards is key to accessibility, availability, innovation, and widespread adoption. Standards provide:

 Cybersecurity that protects systems and data.

 Interoperable components that protect investments in technology and enable growth in the HAN ecosystem.

 Competition among consumer products companies, which drives down costs while increasing choices for consumers.

 Reduced maintenance and support costs caused by proprietary solutions.

 A common understanding of information exchange.

Interoperability of DERs with HAN is key to advancing Smart Grid applications. For purposes of the HAN specifications, a DER is a HAN device with functionality that measures and communicates its full energy production. DERs generate electricity, which may provide for all or a portion of the premises' electrical needs. A DER may be interconnected to the utility electric distribution system, and any net energy flowing on to the electric grid may be recorded in a separate channel on the AMI meter. Additional information about AMI components and open Smart Grid can be found in [UCAIUG], [NETL 2008].

The DER production may also be managed by an EMS that optimizes the premises energy consumption. Also, open standards are key enablers for the success of the IoT, as it is for any kind of M2M communication.

One crucial aspect is how to protect privacy in open systems. Personal privacy can also be compromised when information is disclosed in open systems. Solutions require analysis of several factors. Compelling goals such as accountability, economic growth, free speech, and privacy should be included in any overall decision about whether to disclose information [Swire 2004].

In addition, a designer has to consider regulations on privacy policy, corporate responsibility, and user trust because compliance is required by several committees (e.g. UN Human Rights Watch Group). A committee established in the United States in August 2013 has the task to review policies and regulations on Intelligence and Communications Technologies to support commitment to privacy and civil liberties and maintain the public trust in the United States.